Splunk Search

How to convert kb to GB?

peasead
Path Finder

How do I convert this query to display the results in GB instead of kb?

index="_internal" source="*metrics.log" per_sourcetype_thruput | chart sum(kb) by series

Currently I'm just do a ~result~/1024^2 in Excel, but it'd be stellar to not have to do that as I'm sure Splunk can do the conversion for me.

Also, is there an efficient way to get the results to be listed by Source instead of Source Type? Replacing "per_sourcetype_thruput" with "per_source_thruput" displays all the individual .log files and takes a long long time to complete. If that's the only way, that's fine, I just didn't know if there was another way.

Labels (1)
Tags (3)
0 Karma
1 Solution

hexx
Splunk Employee
Splunk Employee

Very simple :

index="_internal" source="*metrics.log" per_sourcetype_thruput | chart sum(eval(kb/1024/1024)) AS GB by series

I am not sure of how you would like results to be listed by source other than by listing all file names / input sources. Could you elaborate on that? What kind of report would you like to see?

View solution in original post

ldongradi_splun
Splunk Employee
Splunk Employee

You can use the power of 1024, and anticipate the use of a macro, plus you need to use eval out of the sum() if you want to round the results:
index="_internal" source="*metrics.log" per_sourcetype_thruput| chart sum(kb) as Size by series
| eval KB=round(Size/pow(1024,0),2), MB=round(Size/pow(1024,1),2), GB=round(Size/pow(1024,2),2)
| table series, Size, KB, MB, GB

0 Karma

hexx
Splunk Employee
Splunk Employee

Very simple :

index="_internal" source="*metrics.log" per_sourcetype_thruput | chart sum(eval(kb/1024/1024)) AS GB by series

I am not sure of how you would like results to be listed by source other than by listing all file names / input sources. Could you elaborate on that? What kind of report would you like to see?

peasead
Path Finder

Thanks!

That worked!

0 Karma

tfujita_splunk
Splunk Employee
Splunk Employee

This could be also solution for you.

index="_internal" source="*metrics.log" per_sourcetype_thruput
| chart sum(eval(kb*1024)) AS bytes by series

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 10s",printf("%.2f",round(bytes/pow(1024,if(bytes=0,0,floor(min(log(bytes,1024),10)))),2)).case(bytes=0 OR log(bytes,1024)<1,"B ", log(bytes,1024)<2,"KiB", log(bytes,1024)<3,"MiB", log(bytes,1024)<4,"GiB", log(bytes,1024)<5,"TiB", log(bytes,1024)<6,"PiB", log(bytes,1024)<7,"EiB", log(bytes,1024)<8,"ZiB", log(bytes,1024)<9,"YiB", log(bytes,1024)<10,"RiB", log(bytes,1024)<11,"QiB", 1=1, "QiB"))

 

Another option is installing add-on Numeral system macros for Splunk enables you to use macros numeral_binary_symbol(1) or numeral_binary_symbol(2).

Example

index="_internal" source="*metrics.log" per_sourcetype_thruput
| chart sum(eval(kb*1024)) AS bytes by series

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 10s",`numeral_binary_symbol(bytes,2)`)

 

Numeral system macros for Splunk

https://splunkbase.splunk.com/app/6595


Usage:

How to convert a large number to string with expressions of long and short scales, or neither.

https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-large-number-to-string-with-expressio......

Tags (5)
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...